China-Nexus Group Exploited BeyondTrust Remote Support Zero-Day Since 2023, Federal Deadline Today (CVE-2026-102764)

Scope: BeyondTrust Remote Support (formerly Bomgar), self-hosted appliances (SaaS customers already patched as of October 9)

Severity: Red

A China-linked espionage group tracked as Armory Castle, previously known as UNC5221 or Warp Panda, exploited CVE-2026-102764 (CVSS 9.3) to take over self-hosted BeyondTrust Remote Support appliances and deploy a web shell called SAWFLY, with evidence showing the group has been doing this since October 2023. The flaw is an improper origin validation issue in an internal messaging component that lets a remote attacker perform unauthorised file operations on the appliance. BeyondTrust itself describes the attacker’s pattern plainly: the group uses a given zero-day selectively against chosen high-value targets first, then shifts to broadly scanning and exploiting every unpatched instance once the flaw becomes public, which is the exact situation now that this disclosure is out. BeyondTrust has already pushed patches to all SaaS customers, but self-hosted deployments do not update automatically and remain exposed until the administrator applies the fix directly. CISA added this to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of today, October 19, 2026. Organisations running self-hosted BeyondTrust Remote Support must apply patch BT26-05-RS today, restrict external access to only the services actually needed, and given the multi-year activity window, conduct network and memory forensics rather than assuming a clean patch alone clears the device, rebuilding from a known-good state if any sign of prior compromise turns up.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.